One of the most important is that you can't iterate over all the UUIDs. How many data leaks have come from people incrementing an ID in a URL? This is so commo

One of the most important is that you can't iterate over all the UUIDs. How many data leaks have come from people incrementing an ID in a URL? This is so common, I've experienced this myself as a student with a summer job: the company I was working for used an online service for their payroll, I accessed my pay slip one day and changed ?employee=123 to 124 in the URL out of curiosity and it loaded the data for a different person in a different company. They fixed it incredibly quickly once I told them about it :)